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ABSTRACT OF THE DISCLOSURE 

A method for detecting and preventing intrusion in a virtually-wired 
switching fabric. An embodiment provides for a method in which a switch is 
programmed with MAC addresses which are authorized for packets 
processed at each switch port, based on the device coupled to that switch 
port. If the MAC address is authorized, the packet is forwarded. If it is not, 
the packet is dropped. Furthermore, MAC addresses that are learned at a 
port connecting two switches in the fabric are compared to MAC addresses 
that are expected at that port, based on the physical topology of the network. 
If an unexpected MAC address is detected, the topology may be traced to 
locate the host port through which the packet with the unauthorized MAC 
address entered the virtual network. Additionally, the physical topology of 
the network may be periodically compared to the expected topology to 
detect unexpected changes. 
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